Security

Humos holds some of the most sensitive data a person has: sleep, labs, symptoms, and the medications they take. This page describes what we actually do about that. It is a description of our controls, not a certification claim.

Your data is isolated at the database, not the app

Every table holding user data enforces row-level security. Access rules live in the database itself, so a bug in application code cannot hand one user another user's record — the database refuses the read. Writes that need elevated privileges run through a separate service path that is never exposed to the browser.

Access to health data is logged

Reads and changes to health information are written to an append-only audit log: what was touched, by whom, and when. That log is retained after account deletion, because a trail that the subject can erase is not a trail. It holds no health data itself.

Encryption

All traffic to Humos runs over TLS. Data is encrypted at rest by our infrastructure providers. Credentials and third-party access tokens are stored in managed secret storage, never in application code or in our repositories.

Safety is a rule, not a model output

Before any supplement, peptide, or medication reaches your plan, it is checked against everything you already take. That check is deterministic — a rule that either passes or does not — and it runs outside the AI model. An AI system that is confidently wrong about a drug interaction is a safety problem, so we do not let one make that call.

How AI processing works

Generating your plan means sending relevant health context to our AI provider, under contract, for processing on our behalf. That data is not used to train their models, and it is not retained by them for that purpose. We send the context a task needs, not your whole record.

Third parties

We keep the list of providers who process data on our behalf public and current, with what each one touches, in our Privacy Policy. Connections you authorize — wearables, Apple Health, Google Calendar — are yours to revoke at any time from your settings.

What we do not claim

We are pre-launch and we are not going to overstate this. We do not currently hold SOC 2, ISO 27001, or HIPAA attestation, and we will not imply otherwise. We are not a covered entity or a business associate under HIPAA today, and we do not hold ourselves out as one. What we do instead is build to that shape — per-user isolation, an append-only access log, least-privilege service paths — so that an attestation is a matter of audit rather than rearchitecture. If that changes, this page changes with it.

Reporting a vulnerability

If you find a security issue, tell us at security@joinhumos.com. Please include enough detail to reproduce it, and give us a reasonable window to fix it before disclosing publicly. We will not pursue legal action against good-faith research that respects user privacy and avoids data destruction.